DHS' critical infrastructure plan not cyber-secure, GAO says

The Homeland Security Department should reconsider its approach for securing critical infrastructure after a recent review found most of the protective plans developed by agencies to work with different industries haven’t been updated to meet DHS’ cybersecurity requirements, according to the Government Accountability Office.

GAO investigators found that just three of 17 plans to secure critical infrastructure have been updated to include key cybersecurity criteria, according to a report released Oct. 28. Under DHS’ National Infrastructure Protection Plan, designated government agencies and departments be the lead agencies for collaborating with specific industrial sectors and are responsible for developing the protection plans.

According to GAO, only the water, chemical and commercial facilities industrial sector plans had been updated to include the cybersecurity requirements, while others -- such as information technology, telecommunications, nuclear plants and the defense industrial base -- had not.

DHS agreed with GAO’s overall recommendation to review the current approach and said it “supports the ongoing assessment and improvement of the sector planning approach.” However, the department said there were errors, misinterpretations and incorrect conclusions included in the report.

For example, DHS said the report didn’t take into account the many cybersecurity-related activities in various different sectors. DHS also said just because all of the plans hadn’t been fully updated didn’t mean cybersecurity planning and activities in the sectors were lacking. The department also said updates to the plans for 2010 would deal with the cyber requirements.

However, GAO said until the new sector plans are issued, it is unclear if they actually will deal with the cybersecurity requirements. In addition, GAO said agencies haven’t reported on how much progress they made in putting their plans in place, thus making it unclear how the different sectors were putting in place protective measures.

Meanwhile, DHS said sector specific plans are strategic three-year plans and not meant to provide snapshots of agency efforts or to assess progress in protecting critical infrastructure.

GAO said DHS hadn’t made sector planning a priority. “It is essential that federal cybersecurity leaders — including DHS and the to-be-appointed cybersecurity coordinator — exert their leadership roles in this area by, among other things, determining whether it is worthwhile to continue with the current approach as implemented or consider if proposed options provide more effective results,” the report said.

DHS also disputed GAO's assertion that it hadn’t made the sector planning process a priority and said it was actively engaged with the lead agencies and the industrial sector.